Lec 13-14 Assessments and audits

Risk Assessment

Risk Assessment is process of identify potential future events(anticipation of risk) that can go wrong, make negatively impact and harm individuals, assets, environment(risk identification), and making judgement on how tolerable is this negative event(risk analysis). Risk assessment could be qualitative or quantitative. There are formulas for calculating quantitative and qualitative risks. After calculating risk, criteria is established to accept risk or mitigate.

Risk is potential for loss against execution of exploit by threat. Risk is the intersection of assets, threats, and vulnerabilities.

Risk management Strategies:

Accept Risk

Mitigation controls, countermeasure.

Transfer Risk, Insurance

Vulnerability Assessment

Vulnerability Assess is process of identify security holes in computer systems and networks that hacker may use to get unauthorized access to information systems. Vulnerability assessment is only discovering and identifying vulnerabilities and does not involve exploitation of discovered vulnerabilities.

Penetration Testing

Penetration Testing is exploitation of discovered likely vulnerabilies.

Monitoring and analysis tools

  • For war driving, netstumbler, inSSIDer.
  • For protocol analysis, wireshark.
  • For IDS, Snort, Zone Alarm.
  • Nmap for scanning.
  • Windows event viewer.
  • Syslog, as logging tool

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s